start::
closeprocesses:
createrestorepoint:
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"SmartScreenEnabled"="warm"
EndRegedit:
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\StartupApproved\StartupFolder: => "Canon IJ Status Monitor Canon TS3100 series (Copie 2) (Local).lnk"
FirewallRules: [{B1DFFC61-E5AF-4065-A12C-E8AE5196B33B}] => (Block) C:\Program Files (x86)\Avira\SoftwareUpdater\avirasoftwareupdatertoastnotificationsbridge.exe (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
FirewallRules: [{1AB1C59E-FEC3-42D1-89FB-1DD12D1158C1}] => (Allow) C:\Program Files (x86)\Avira\SoftwareUpdater\avirasoftwareupdatertoastnotificationsbridge.exe (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
FirewallRules: [{62D8F113-5ADA-4A09-B310-8F66368F9356}] => (Allow) C:\Program Files (x86)\Avira\SoftwareUpdater\avirasoftwareupdatertoastnotificationsbridge.exe (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
C:\Program Files (x86)\Avira
HKLM-x32\...\Run: [CompeGPSDev] => [X]
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {1c0926ac-0567-11eb-a689-806e6f6e6963} - "F:\Msetup4.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {1c093341-0567-11eb-a689-54271ed2e95a} - "H:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {1c09337e-0567-11eb-a689-54271ed2e95a} - "H:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {28c91f30-6b65-11eb-a6e3-54271ed2e95a} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {32d72ca8-92dc-11ec-a7e9-10c37b9e65f6} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {63d21586-46a0-11ec-a799-10c37b9e65f6} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {8d50b13e-2690-11eb-a6aa-54271ed2e95a} - "H:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {9bea76d8-3d34-11ec-a78f-10c37b9e65f6} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {c0ad8462-ee95-11eb-a75a-10c37b9e65f6} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {ca614a1d-408b-11eb-a6c3-54271ed2e95a} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {caa8bdc4-085a-11eb-a68a-54271ed2e95a} - "H:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-3732846031-1231393311-410780189-1001\...\MountPoints2: {fac980e9-d0b6-11eb-a735-10c37b9e65f6} - "F:\HiSuiteDownLoader.exe"
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Canon IJ Status Monitor Canon TS3100 series (Copie 2) (Local).lnk [2020-10-10]
ShortcutAndArgument: Canon IJ Status Monitor Canon TS3100 series (Copie 2) (Local).lnk -> C:\Windows\system32\rundll32.exe => "C:\Users\user\CNMSSC~1.DLL",SMStarterEntryPoint "C:\Windows\system32\spool\DRIVERS\x64\3\cnmsmdr.dll" "Canon IJ Status Monitor Canon TS3100 series (Copie 2) (Local).lnk"
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== ATTENTION (Restriction - Zones)
Edge Extension: (Pas de nom) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [non trouvé(e)]
Edge Extension: (Pas de nom) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [non trouvé(e)]
Edge Extension: (Pas de nom) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [non trouvé(e)]
Edge Extension: (Pas de nom) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [non trouvé(e)]
FF Plugin-x32: @videolan.org/vlc,version=3.0.16 -> C:\Users\user\Desktop\VLC\npvlc.dll [Pas de fichier]
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll]
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
2022-03-01 15:51 - 2022-03-01 15:51 - 000000000 ____D C:\Windows\system32\Tasks\Avira
2022-03-01 15:53 - 2021-05-03 15:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2022-03-01 15:53 - 2020-10-02 13:41 - 000000000 ____D C:\ProgramData\Avira
2022-01-28 09:29 - 2022-01-28 09:29 - 000224072 _____ (AVG Technologies CZ, s.r.o.) C:\Users\user\avg_antivirus_free_setup.exe
2022-01-28 08:39 - 2022-01-28 08:39 - 005511904 _____ (Avira Operations GmbH & Co. KG) C:\Users\user\avira_fr_sptl1_1412645248-1643355560__adwg.exe
cmd: sfc /scannow
emptytemp:
end::